CVE-2024-6548 is a medium severity vulnerability in the coffee2code Add Admin JavaScript WordPress plugin (up to version 2.0) that causes full path disclosure. The issue arises from the plugin using bootstrap and leaving test files with display_errors enabled, which reveals the full filesystem path to unauthenticated users. This exposure of sensitive information (CWE-200) can aid attackers in identifying the server environment and potentially facilitate other attacks, though it does not directly lead to compromise by itself. No patch or remediation has been documented, and no known exploits are reported.

The vulnerability exposes the full filesystem path of the web application to unauthenticated attackers. This information disclosure is classified as low impact on confidentiality (partial information leak) and does not affect integrity or availability. On its own, the disclosed information is not sufficient to compromise the system but may assist attackers in exploiting other vulnerabilities if present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the Add Admin JavaScript plugin if it is not essential. Additionally, ensure that PHP error display settings (display_errors) are disabled on production environments to prevent information leakage.